Azure-devops-docs: Cannot remove inheritance using command line

[jmelosegui]

Following this document to remove privileges to create branches at the root level but allow to create them inside the features folder I end up the following.

Project: MyProject
Repository: MyRepo
Branch: refs/heads/features
(Inherit: Yes)

  Identity: [MyProject]\Contributors
    Allow:             CreateBranch
    Deny:
    Allow (Inherited): GenericRead, GenericContribute, CreateTag, ManageNote
    Deny (Inherited):  CreateBranch

which results in an inability to create branches under the desired folder due to the Deny (Inherited): CreateBranch from the parent.

Is there any way to remove inheritance through the command line?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: baa3aa13-7e1e-b327-132b-26fdfd2c0f6e
• Version Independent ID: d62debf7-71cc-2f94-faf2-b83393aa85d9
• Content: Git permission command
• Content Source: docs/tfvc/git-permission-command.md
• Product: devops
• GitHub Login: @steved0x
• Microsoft Alias: sdanie

[steved0x]

@jmelosegui Sorry that it took a little while to take a look at this one, were you able to get it resolved? If not, can you show me the commands that you used to allow the CreateBranch permissions? (And the command used to get the report above) (You can replace the parts of your URLs with * that show your account names)

There is more information on how these permissions interact here: https://docs.microsoft.com/en-us/vsts/organizations/security/about-permissions?view=vsts#permission-settings

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[DmitriyKirakosyan]

reassign @DmitriyKirakosyan

[DmitriyKirakosyan]

@jmelosegui I've tested this case and it worked as expected for me.
Steps:

1. Created a private repo
2. Setup branch permissions as it is described in the doc
3. Added a user to Contributors group
4. Logged in with the added user and tried to create some branches.

Result: As expected, I could only create branches started with features/ and users/. Same result when using the git CLI.

Regarding your output, I believe that it shows the __inherited__ __allow__ and __deny__ permissions, which is set in its parent, and its own permissions, which override the __inherited__ ones. This means adding a permission, eg /allow:CreateBranch won't remove its inherited permissions but will override it. So it's just the way it works and displayed.

Please let me know it works for you.
In case you're still having troubles setting up the permissions, please provide more details and steps to reproduce the issue.

[MaximMalygin]

@steved0x can we closed this? Because issue was created 2 years ago, now @jmelosegui didn't responed and everything work as expected

[MaximMalygin]

@msebolt could you please see my last comment, can we close this?